The Act of 20 June 2018 added a cross-reference to articles 4(11) and 7 of the
GDPR. The Ordinance of 12 December 2018 simplifies and retains now only a
cross-reference to GDPR.
Consent is in actual fact one basis among other legitimate bases allowing personal
data to be processed.
64 It should be observed, however, that the restrictive interpretation of the other bases has led to pride of place being given to consent.
65 Moreover,
these various bases are not mutually exclusive. Several of them may justify the
existence of one and the same processing. Lastly there is no criminal penalty for the
absence of any of the conditions of article 7.
66
Where required, the data subject’s consent to the processing of their data must be
prior,
67 simple and specific: it cannot be limited to acceptance of general terms and
conditions of use.
There are specific rules for sensitive data, which were amended by the Act of
20 June 2018 (see above). Although the processing of such data is prohibited in
principle, there are many exceptions to this prohibition (e.g. medical reasons,
research, and statistics). The processing of sensitive data has required the data
subject’s consent from the outset.
The LIL notably contains special provisions for health law.
68 New article 63 LIL
provides “where research requires genetic characteristics to be examined, the
informed and express consent of data subjects shall be obtained before data
processing is implemented”.
There are also specific rules e.g. for on-line publications, journalists,
69 data
transfers, marketing,
70 and criminal matters.
71 In this last area, the scope of application of the LIL is broader than that of the GDPR.
72
Contrary to what was provided in the draft legislative act on personal data
protection, the legislator used the possibility afforded by article 8 of the GDPR to
lower the age of consent of minors for the provision of information society services
to 15 years.
73 A “strong educational and awareness policy” must be introduced
because of the dangers of the Internet for minors.
74 Controllers must provide minors
with information about the processing of their data “in plain language that is easy to
understand”.
75
64 See Debet et al. (2015), p. 298.
65 Debet (2018), p. 39.
66 Debet et al. (2015), p. 304.
67 For example: CA 21 September 2017, no 15/23732.
68 LIL, Articles 64 ff.
69 LIL, Article 80.
70 Code des postes et des communications électroniques (CPCE), Article L 34-5.
71 LIL, Article. 46 & Article 87 ff.
72 Bourgeois (2017), no 413.
73 LIL, Article 45.
74 Charrier (2018), p. 335 ff.
75 LIL, Article 45.
Data Protection in the Internet: French Report
167
GDPR. The Ordinance of 12 December 2018 simplifies and retains now only a
cross-reference to GDPR.
Consent is in actual fact one basis among other legitimate bases allowing personal
data to be processed.
64 It should be observed, however, that the restrictive interpretation of the other bases has led to pride of place being given to consent.
65 Moreover,
these various bases are not mutually exclusive. Several of them may justify the
existence of one and the same processing. Lastly there is no criminal penalty for the
absence of any of the conditions of article 7.
66
Where required, the data subject’s consent to the processing of their data must be
prior,
67 simple and specific: it cannot be limited to acceptance of general terms and
conditions of use.
There are specific rules for sensitive data, which were amended by the Act of
20 June 2018 (see above). Although the processing of such data is prohibited in
principle, there are many exceptions to this prohibition (e.g. medical reasons,
research, and statistics). The processing of sensitive data has required the data
subject’s consent from the outset.
The LIL notably contains special provisions for health law.
68 New article 63 LIL
provides “where research requires genetic characteristics to be examined, the
informed and express consent of data subjects shall be obtained before data
processing is implemented”.
There are also specific rules e.g. for on-line publications, journalists,
69 data
transfers, marketing,
70 and criminal matters.
71 In this last area, the scope of application of the LIL is broader than that of the GDPR.
72
Contrary to what was provided in the draft legislative act on personal data
protection, the legislator used the possibility afforded by article 8 of the GDPR to
lower the age of consent of minors for the provision of information society services
to 15 years.
73 A “strong educational and awareness policy” must be introduced
because of the dangers of the Internet for minors.
74 Controllers must provide minors
with information about the processing of their data “in plain language that is easy to
understand”.
75
64 See Debet et al. (2015), p. 298.
65 Debet (2018), p. 39.
66 Debet et al. (2015), p. 304.
67 For example: CA 21 September 2017, no 15/23732.
68 LIL, Articles 64 ff.
69 LIL, Article 80.
70 Code des postes et des communications électroniques (CPCE), Article L 34-5.
71 LIL, Article. 46 & Article 87 ff.
72 Bourgeois (2017), no 413.
73 LIL, Article 45.
74 Charrier (2018), p. 335 ff.
75 LIL, Article 45.
Data Protection in the Internet: French Report
167